CVE-2024-40896
CVE-2024-40896
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.1EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
23 Dec 2024Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected products
libxml2 · libxml2Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →